Compromising online accounts by cracking voicemail systems Martin - - PowerPoint PPT Presentation

▶
compromising online accounts by cracking voicemail systems
SMART_READER_LITE
LIVE PREVIEW

Compromising online accounts by cracking voicemail systems Martin - - PowerPoint PPT Presentation

Oct 28, 2023 187 likes •770 views

Compromising online accounts by cracking voicemail systems Martin Vigo @martin_vigo | martinvigo.com 8 2 1 6 C P C d n a e m r r c t l e d s a d m a b A A a L g n i y a l p e l i h w d

slide-1
SLIDE 1

Compromising online accounts by cracking voicemail systems

Martin Vigo

@martin_vigo | martinvigo.com

slide-2
SLIDE 2

Martin Vigo

Product Security Lead From Galicia, Spain Research | Scuba | Gin tonics @martin_vigo - martinvigo.com

A m s t r a d C P C 6 1 2 8

C a p t u r e d w h i l e p l a y i n g “ L a A b a d í a d e l c r í m e n ”

slide-3
SLIDE 3

History

back to ezines

slide-4
SLIDE 4

Hacking Telephone Answering Machines by Doctor Pizz and Cybersperm

“You can just enter all 2-digit combinations until you get the right one” … “A more sophisticated and fast way to do this is to take advantage of the fact that such machines typically do not read two numbers at a time, and discard them, but just look for the correct sequence”

slide-5
SLIDE 5

Hacking AT&T Answering Machines Quick and Dirty by oleBuzzard

“Quickly Enter the following string: 123456789876543213579246864297314741933669944885522775395 96372582838491817161511026203040506070809001 (this is the shortest string for entering every possible 2-digit combo.)”

slide-6
SLIDE 6

A Tutorial of Aspen Voice Mailbox Systems, by Slycath

“Defaults For ASPEN Are: (E.G. Box is 888) …. Use Normal Hacking Techniques:

  • i.e.

1111 | \|/ 9999 1234 4321”

slide-7
SLIDE 7

Hacking Answering Machines 1990 by Predat0r

“There is also the old "change the message" secret to make it say something to the effect of this line accepts all toll charges so you can bill third party calls to that number”

slide-8
SLIDE 8

Voicemail security in the ‘80s

  • Default PINs
  • Common PINs
  • Bruteforceable PINs
  • Efficient bruteforcing sending multiple PINs at once
  • The greeting message is an attack vector
slide-9
SLIDE 9

Voicemail security today

checklist time!

slide-10
SLIDE 10

Voicemail security today

Default PINs

  • Common PINs
  • Bruteforceable PINs
  • Efficient bruteforcing

by entering multiple PINs at once

  • The greeting

message is an attack vector

  • AT&T
  • 111111
  • T-Mobile
  • Last 4 digits of the phone number
  • Sprint
  • Last 7 digit of the phone number
  • Verizon
  • Last 4 digits of the phone number
  • Vodafone
  • 4 last digits of client number
  • 4 last digits of PUK for CallYa
  • Telekom
  • 4 last digits of card number
  • O2
  • 8705
slide-11
SLIDE 11

Voicemail security today

Default PINs Common PINs

  • Bruteforceable PINs
  • Efficient bruteforcing

by entering multiple PINs at once

  • The greeting

message is an attack vector

2012 Research study by Data Genetics https://www.datagenetics.com/blog/september32012

slide-12
SLIDE 12

Voicemail security today

Default PINs Common PINs Bruteforceable PINs

  • Efficient bruteforcing

by entering multiple PINs at once

  • The greeting

message is an attack vector

  • AT&T
  • 4 to 10 digits
  • T-Mobile
  • 4 to 7 digits
  • Sprint
  • 4 to 10 digits
  • Verizon
  • 4 to 6 digits
  • Vodafone
  • 4 to 7 digits
  • Telekom
  • 4 to 10 digits
  • O2
  • 4 to 10 digits
slide-13
SLIDE 13

Voicemail security today

Default PINs Common PINs Bruteforceable PINs Efficient bruteforcing by entering multiple PINs at once

  • The greeting

message is an attack vector

  • Supports multiple pins at a time
  • 0000#1111#2222#
  • Without waiting for prompt
  • or error messages
slide-14
SLIDE 14

voicemailcracker.py

bruteforcing voicemails fast, cheap, easy, efficiently and undetected

slide-15
SLIDE 15

voicemailcracker.py

  • Fast
  • Uses Twilio’s APIs to make hundreds
  • f calls at a time
  • Cheap
  • Entire 4 digits keyspace for $40
  • A 50% chance of correctly guessing a

4 digit PIN for $5

  • Check 1000 phone numbers for

default PIN for $13

  • Easy
  • Fully automated
  • Configured with specific payloads for

major carriers

  • Efficient
  • Optimizes bruteforcing
  • Tries multiple PINs in the same call
  • Uses existing research to prioritize default

PINs, common PINs, patterns, etc.

slide-16
SLIDE 16

Undetected

slide-17
SLIDE 17

Straight to voicemail

  • Multiple calls at the same time
  • It’s how slydial service works in reality
  • Call when phone is offline
  • OSINT
  • Airplane, movie theater, remote trip, Do

Not Disturb

  • Query HLR database
  • Online services like realphonevalidation.com
  • Class 0 SMS
  • Reports back if it was displayed
  • Use backdoor voicemail

numbers

  • No need to call the victim!

AT&T: 408-307-5049 Verizon: 301-802-6245 T-Mobile: 805-637-7243 Sprint: 513-225-6245

Vodafone: XXX-55-XXXXXXXX Telekom: XXX-13-XXXXXXXX O2: XXX-33-XXXXXXXX

slide-18
SLIDE 18

voicemailcracker.py

  • Fast
  • Uses Twilio’s APIs to make hundreds
  • f calls at a time
  • Cheap
  • Entire 4 digits keyspace for $40
  • A 50% chance of correctly guessing a

4 digit PIN for $5

  • Check 1000 phone numbers for

default PIN for $13

  • Easy
  • Fully automated
  • Configured with specific payloads for major carriers
  • Efficient
  • Optimizes bruteforcing
  • Tries multiple PINs in the same call
  • Uses existing research to prioritize default PINs,

common PINs, patterns, etc.

  • Undetected
  • Supports backdoor voicemail numbers
slide-19
SLIDE 19

Bruteforce protections

slide-20
SLIDE 20

Different flavors in Germany

Vodafone

Resets to a 6 digit PIN and sends it over SMS

Telekom

Blocks the Caller ID from accessing mailbox

  • r even leaving messages

O2

Connects directly to customer help-line

slide-21
SLIDE 21

Caller IDs are cheap

Vodafone

Resets to a 6 digit PIN and sends it over SMS

Telekom

Blocks the Caller ID from accessing mailbox

  • r even leaving messages

O2

Connects directly to customer help-line

slide-22
SLIDE 22

voicemailcracker.py

  • Fast
  • Uses Twilio’s APIs to make hundreds
  • f calls at a time
  • Cheap
  • Entire 4 digits keyspace for $40
  • A 50% chance of correctly guessing a

4 digit PIN for $5

  • Check 1000 phone numbers for

default PIN for $13

  • Easy
  • Fully automated
  • Configured with specific payloads for major carriers
  • Efficient
  • Optimizes bruteforcing
  • Tries multiple PINs in the same call
  • Uses existing research to prioritize default PINs, common PINs,

patterns, etc.

  • Undetected
  • Supports backdoor voicemail numbers
  • Bruteforce protection bypass
  • Supports Caller ID randomization
slide-23
SLIDE 23

Demo

bruteforcing voicemail systems with voicemailcracker.py

slide-24
SLIDE 24
slide-25
SLIDE 25

Impact

so what?

slide-26
SLIDE 26
slide-27
SLIDE 27

What happens if you don’t pick up?

slide-28
SLIDE 28

Voicemail takes the call and records it!

slide-29
SLIDE 29

Attack vector

  • 1. Bruteforce voicemail system, ideally using backdoor numbers
  • 2. Ensure calls go straight to voicemail (call flooding, OSINT, etc.)
  • 3. Start password reset process using “Call me” feature
  • 4. Listen to the recorded message containing the secret code
  • 5. Profit!

voicemailcracker.py can do all this automatically

slide-30
SLIDE 30

Demo

compromising WhatsApp

slide-31
SLIDE 31
slide-32
SLIDE 32

We done? Not yet…

slide-33
SLIDE 33

User interaction based protection

Please press any key to hear the code… Please press [ARANDOMKEY] to hear the code… Please enter the code…

slide-34
SLIDE 34

Can we beat this recommended protection?

slide-35
SLIDE 35

Hint

slide-36
SLIDE 36

Another hint

Default PINs Common PINs Bruteforceable PINs Efficient bruteforcing by entering multiple PINs at once The greeting message is an attack vector

slide-37
SLIDE 37

We can record DTMF tones as the greeting message!

slide-38
SLIDE 38

Attack vector

  • 1. Bruteforce voicemail system, ideally using backdoor numbers
  • 2. Update greeting message according to the account to be hacked
  • 3. Ensure calls go straight to voicemail (call flooding, OSINT, etc.)
  • 4. Start password reset process using “Call me” feature
  • 5. Listen to the recorded message containing the secret code
  • 6. Profit!

voicemailcracker.py can do all this automatically

slide-39
SLIDE 39

Demo

compromising Paypal

slide-40
SLIDE 40
slide-41
SLIDE 41

Vulnerable services

small subset

slide-42
SLIDE 42

Password reset

slide-43
SLIDE 43

2FA

slide-44
SLIDE 44

Verification

slide-45
SLIDE 45

Physical security

slide-46
SLIDE 46

Consent

slide-47
SLIDE 47
slide-48
SLIDE 48

Open source

slide-49
SLIDE 49

voicemailautomator.py

  • No bruteforcing
  • Limited to 1 carrier
  • Change greeting message with specially crafted payloads
  • Retrieve messages containing the secret temp codes

Git repo: github.com/martinvigo/voicemailautomator

slide-50
SLIDE 50

Recommendations

slide-51
SLIDE 51

Still…do I care?

if (carriersSetDefaultPins == TRUE) if (testingForDefaultPinsCheapFastUndetectedAutomatable == TRUE) if (updatingGreetingMessageAutomatable == TRUE) if (retrievingNewestMessageAutomatable == TRUE) if (speechToTextTranscription == TRUE) if (accountCompromiseIsAutomatable == TRUE) print “Yes, I should care”

slide-52
SLIDE 52

Recommendations for online services

  • Don’t use automated calls for security purposes
  • If not possible, detect answering machine and fail
  • Require user interaction before providing the secret
  • with the hope that carriers ban DTMF tones from greeting messages
slide-53
SLIDE 53

Recommendations for carriers

  • Ban DTMF tones from greeting

messages

  • Eliminate backdoor voicemail

services

  • or at least no access to login

prompt from them

  • Voicemail disabled by default
  • and can only be activated from the

actual phone or online

  • No default PIN
  • Don’t allow common PINs
  • Detect and prevent bruteforce attempts
  • Don’t process multiple PINs at once
slide-54
SLIDE 54

Recommendations for you

  • Disable voicemail
  • or use longest possible, random PIN
  • Don’t provide phone number to online services unless

required

  • or it’s the only way to get 2FA
  • use a virtual number to prevent OSINT and SIM swapping
  • Use 2FA apps only
slide-55
SLIDE 55

TL;DR

Automated phone calls are a common solution for password reset, 2FA, verification and other services. These can be compromised by leveraging old weaknesses and current technology to exploit the weakest link, voicemail systems

Strong password policy 2FA enforced A+ in OWASP Top 10 checklist Abuse/Bruteforce prevention Password reset | 2FA | Verification | Consent

  • ver phone call

Military grade crypto end to end Lots of cyber

slide-56
SLIDE 56

Danke schön!

@martin_vigo martinvigo.com martinvigo@gmail.com linkedin.com/in/martinvigo github.com/martinvigo youtube.com/martinvigo